Many network devices are typically required to support multimedia and data networks. Configuring and managing these separate network devices to support traditional and multimedia traffic, including VoIP, is a very complex task. In a typical prior art network system, each and every device must be configured and managed in order for each to “hand-shake” or be compatible with each other. These activities obviously require tremendous amounts of time and skilled resources. The mix of voice, video and data services creates substantial complexity in routers, DHCP (Dynamic Host Control Protocol), NAT (Network Address Translation) and proxy devices, secure firewalls and QoS (Quality of Service), at the expense of ease-of-use. There is a great need in the art for a complete network-in-a-box solution to address these problems—an invention which facilitates voice, video and data communication by combining the above features. The novel aspects of the present invention address the unique problems encountered by prior art networks which deliver real-time multimedia and data services such as VoIP over public IP networks.
Below is a brief discussion of seven different components in a typical prior art network and the respective solutions offered by the present invention: (1) Firewall Proxy, (2) Network Address Translation (NAT) or Masquerading Proxy, (3) Call Agent Proxy/Application Layer Gateway (ALG), (4) Quality of Service (QoS), (5) Remote Management and Other Services, (6) QoS and Performance Test Client, and (7) Lifeline, 911 Gateway.
(1) Firewall Proxy—A firewall is required at the customer premise to protect against attacks from the public network. However, firewalls typically block traffic, including VoIP calls, that are not originated from inside the firewall. Holes can be poked in the firewall allowing particular ports or port ranges to be opened. However, the RTP (Real-time Transport Protocol) streams used to carry voice traffic can use a wide range of UDP (User Datagram Protocol) ports, which if opened, could increase security risks. The MAND implements a proxy to manage security for voice traffic and limit dynamic port ranges.
(2) Network Address Translation (NAT) or Masquerading Proxy—Without NAT or masquerading, every IP phone on a company network would require a unique public IP address. Because of a shortage of public addresses, this is often not practical. NAT allows many private IP addresses to be mapped to a single public address. However, another feature of NAT typically used for security, is that devices behind NAT are hidden and not directly addressable from the public network. This is a problem for IP phone devices that need to accept calls from the public network. The MAND implements a call agent proxy to map the common public address to unique private addresses.
(3) Call Agent Proxy/Application Layer Gateway (ALG)—The ALG function provides dynamic VoIP and media port management. The ALG parses each H.323, SIP or MGCP signaling packet and dynamically creates, opens and closes UDP ports to carry Real-time Transport Protocol (RTP) or Real-time Transport Control Protocol (RTCP) media packets providing end-to-end media communications. The ALG manages media transmissions, translating and delivering media packets to the private UDP ports.
(4) Quality of Service (QoS)—Real time communications traffic such as VoIP is very sensitive to congestion, latency and jitter. When voice and data traffic travel over a common IP network, data traffic such as file transfers can congest constrained WAN links causing significant degradation of voice quality.
There are several QoS mechanisms that can be used to prioritize real-time voice traffic over data traffic. Ethernet or IP packets can be tagged using 802.1p, IP-ToS, IP Precedence or Diffserv, and then prioritized in switches and routers. However, these mechanisms are not practical in many cases because of limited deployment and lack of policy management to control how packets are tagged. Queuing schemes can be implemented in customer premise routers to prioritize outbound traffic, but more commonly the congestion problem is from web downloads and other inbound traffic. Throwing out packets at the router does not prevent a narrow WAN link from being congested from traffic coming into the link from the Internet.
In order to solve these problems, the MAND supports traffic shaping in addition to tagging and queuing mechanisms. The MAND at the customer premise running traffic shaping can prioritize outbound traffic as well as free up inbound bandwidth for higher priority voice traffic. This is done by forcing the lower priority inbound data traffic to back-off so that it does not congest the WAN link.
Another problem with VoIP is that if the number of calls exceed the bandwidth of the communication link, all calls degrade. The MAND provides Client Access Control (CAC) that restricts the number of simultaneous calls to a configured number.
(5) Remote Management and Other Services—Without the MAND, a customer typically would need to purchase, configure and manage several different network devices including a router with NAT, DHCP server, firewall, VoIP proxy and traffic shaper. Configuring all of these devices to work together and managing them for mission critical voice applications is a complex task, particularly for small and medium businesses. Service providers offering outsourced VoIP services to these businesses also would have a very limited ability to assist the customer with these devices, or to identify problems by segmenting customer from network equipment while isolating problem network components.
In addition to Firewall/NAT proxy services and traffic shaping, the MAND can be configured to act as an IP router, a NAT/Masquerading server, ALG, a DHCP (Dynamic Host Configuration Protocol) server, and a firewall. The MAND can provide all of these services in a single device with a simplified common management interface. In addition, the MAND provides a remote management interface that allows a service provider to remotely configure, manage, diagnose, isolate faults, monitor performance and upgrade the device for the customer.
The MAND also supports IP voice device plug and play. IP voice devices can issue a broadcast message to discover the MAND to request configuration information.
The MAND also provides virtual private network termination with optional packet encryption. VPN technology provides a secure connection between the MAND and a service provider or another VPN termination device. The present MAND embodiment uses hardware accelerator circuits for real-time packet encryption.
(6) Performance Test Client—Service providers offering outsourced VoIP services need a way to determine the Quality of Service (QoS) that can be delivered to customers over Internet connections and troubleshoot QoS and performance problems. Most VoIP client devices have limited ability to report QoS and performance information. The MAND implements a performance test client application that allows remote monitoring of the QoS that can be delivered to the customer premise.
(7) Lifeline, 911 Gateway—With VoIP services, if there is a power outage at the customer facility and the data network devices and phones are not connected to a UPS (Uninterruptible Power Supply), the customer can lose voice services. In addition, if users dial 911 from a VoIP phone, the ANI (Automatic Number Identification) must be sent to the PSAP (Public Safety Answering Point) so the 911 service can identify the location of the caller. To address these issues, the MAND can be configured with FXO (Foreign Exchange Office) ports that connect to PSTN analog phone lines as well as FXS (Foreign Exchange Station) ports that can be connected to analog telephones or devices.